1. Network Security – Part 2 V.T. Raja, Ph.D., Oregon State University

2. BA483: Network Security Part 2 - Outline Public Key Cryptography Public keys and Private keys RSA Algorithm Authentication Authentication Protocol (ap) –ap 1.0, 2.0, 3.0, 3.1, 4.0, 5.0 Exchanging Public Keys Man (Woman) in the middle-attack

3. Introduction - Public Key Cryptography Disadvantage of symmetric key cryptography? –Agreeing upon a shared symmetric key in a secure manner Until 1970s encryption involved symmetric key Is it possible for two parties to communicate using encryption/decryption without using a shared secret key? –Yes. Using public key cryptography A radically different and marvelously elegant approach towards encryption/decryption Public key cryptography is useful not only for encryption/decryption, but also for authentication and digital signatures as well.

4. Basic Idea of Public Key Cryptography Each participant has a private key (known only to the participant) and a public key. The public key is created with one’s private key. Public key is made available to others and could be posted even on a website which is accessible by the rest of the world. Public key of recipient is used by sender to encrypt message. Recipient decrypts message using recipient’s private key.

5. Example: Using Public Key Cryptography Example: –Alice wishes to send a message to Bob. –Alice fetches Bob’s public key. –Alice uses Bob’s public key to encrypt message –Alice sends encrypted message to Bob. –Bob decrypts cipher text with Bob’s private key.

6. Notation and Choice of Keys Assume Alice’s plain text message, (which has to be encrypted and then sent to Bob) is denoted as m. Assume Bob’s public key is denoted as K B + and his private key is denoted as K B -. These keys are chosen such that: K B - (K B + (m)) = K B + (K B - (m)) = m

7. RSA Algorithm How does RSA work? Class Participation Exercise on RSA application Why does RSA work? (See MS Word handout for answers to above questions)

8. RSA Algorithm Even for small p and q, as seen in the participation exercise, we had to deal with extremely large numbers. If we follow the suggestion of RSA labs and select p and q to be several hundred bits long, then the following practical issues come to mind: –How to choose large prime numbers p and q? –How to choose e and d? –How to perform exponentiation with large numbers?

9. RSA and DES/AES DES is at least 100 times faster than RSA. In practice, RSA is often used in combination with DES or AES. How? –Alice encrypts DES key with Bob’s public key –Bob decrypts and obtains DES key with his private key –Data is encrypted using DES key, (which now both Alice and Bob have access to in order to encrypt/decrypt data).

10. Security of RSA The security of RSA relies on the fact that there are no known algorithms for quickly factoring a number (n), into the primes p and q. If one knew p and q, then given e, one could then easily compute the secret key d. It is not known whether or not there exist fast algorithms for factoring a number, and in this sense the security of RSA is not guaranteed.

11. Authentication ap 1.0 –Alice announces to Bob, “I am Alice.” Trudy could have sent this message. ap 2.0 –Alice announces to Bob, “I am Alice”, and asks Bob to authenticate her by matching source IP (in IP header) with Alice’s IP. Trudy could have sent this message if she had done IP spoofing.

12. Authentication ap 3.0 –Alice announces to Bob, “I am Alice”, and asks Bob to authenticate her by verifying her plaintext password. Trudy may have already eavesdropped earlier, and have stolen Alice’s plaintext password during an earlier conversation between Alice and Bob. Now, Trudy could send the message, “I am Alice” by using Alice’s plaintext password. ap 3.1 –Alice announces to Bob, “I am Alice”, and asks Bob to authenticate her by verifying her encrypted password, which is kept the same for different communication sessions between Bob and Alice. Same disadvantage mentioned in ap 3.0 still exists. Note that Trudy need not decrypt the password. She could still eavesdrop, steal encrypted password, and then perform a “playback attack” on Bob.

13. Authentication ap 4.0 –Alice announces to Bob, “I am Alice.” –Bob sends a plaintext nonce (= r) to Alice. Note that nonce is a one time value that is specific to that communication session. It is not repeated again in another session. So “playback attack” is not possible. –Alice resends same nonce back to Bob but this time nonce is encrypted with symmetric key used by Alice and Bob. –Bob decrypts nonce using symmetric key. If decrypted nonce equals the nonce he sent Alice earlier (i.e. decrypted nonce = r), then Alice is authenticated. –However, this implies that Alice and Bob must have decided upon and exchanged their symmetric key.

14. Authentication ap 5.0 –Alice announces to Bob, “I am Alice.” –Bob sends a plaintext nonce (= r) to Alice. Since nonce is a one-time value, “playback attack” is not possible. –Alice resends same nonce back to Bob but this time nonce is encrypted with Alice’s private key. –Bob decrypts nonce using Alice’s public key. If decrypted nonce equals the nonce he sent Alice earlier (i.e. decrypted nonce = r), then Alice is authenticated.

15. Exchanging Public Keys Why should public key be publicly available? Wouldn’t it be better for Alice and Bob to exchange their respective public keys via e-mail, after authenticating each other? –Due to possibility of “man (woman) in the middle attack.”

16. Man (Woman) in the Middle Attack Alice transmits, “I am Alice.” Trudy (alias Eve) eavesdrops. Bob sends a nonce = r. Trudy intercepts nonce, and sends Bob encrypted nonce (encrypted using her private key). Bob sends a message to Alice asking her for a public key. Trudy intercepts message, and sends Bob Trudy’s public key. Bob decrypts nonce with Trudy’s public key (thinking that he is using Alice’s public key), and inadvertently authenticates Trudy. While Bob is encrypting new data using Trudy’s public key, Trudy is busy posing as Bob to Alice. In particular, –Trudy transmits Bob’s nonce to Alice –Alice transmits encrypted nonce (encrypted using Alice’s private key). –Trudy intercepts encrypted nonce, and asks Alice for her public key. –Alice sends her public key

17. Man (Woman) in the Middle Attack Bob sends encrypted data (encrypted using Trudy’s public key) Trudy decrypts using her private key, and finds out Bob’s plain text. Trudy encrypts Bob’s plain text using Alice’s public key. Trudy transmits encrypted text to Alice. Alice decrypts using her private key, and finds out Bob’s plain text. Alice and Bob are happy that they have had a secure communication. They are ignorant of the fact that Trudy has intercepted and decrypted Bob’s message to Alice.

18. Public Key Certification PK cryptography – possible for two entities to exchange secret messages without having to exchange secret keys. Communicating entities have to exchange public keys (without being subject to “man in the middle attack”). Binding a public key to a particular entity is typically done by a Certification Authority (CA).

19. Certification Authority A CA verifies that an entity is who it claims to be. After verification, CA creates a certificate that binds the public key of the entity to the identity. Certificate – includes a public key – includes globally unique identifying information about owner of the public key –Is digitally signed by CA (Internet Explorer – Tools, Internet Options, Content, Certificates)

20. Digital Signatures and Message Digests Assume Bob wants to digitally sign a “document,” m. Bob’s digital signature could be K B - (m) Due to complexity of RSA, digital signatures are applied to “fingerprints” instead of being applied to message m. Fingerprint – H(m) – where H denotes a “hash algorithm” Bob’s digital signature is K B - (H(m))

21. Message Digests Message Digest (Hash) algorithms: –MD5; SHA-1; SHA-224;-256;-384;-512 Secure Hash Algorithm is a U.S. federal standard Required for use whenever a secure message digest algorithm is required for federal applications Produces a 160-bit message digest. Longer the output length, the more secure SHA-1 SHA-224, SHA-256, SHA-384, and SHA-512, which despite the similarity of names, are actually fairly different algorithms to SHA-1 and have much wider safety margins.